/*
* We assume that principals are able to securely lookup the required hash
* keys. We formally express this by assuming the existence of a secure lookup
* function of the following dependent function type:
*/